我正在尝试为 GSSAPI 配置 Kerberos 目前我有两个节点，一个是 KDC 服务器（Windows 服务器 2016），另一个是 Postgres-server（Ubuntu）。我在 kdc-server 中创建了 Active Directory，并创建了名为 postgres 的用户，并选择了“密码永不过期”选项。
然后我安装了 MIT 的 kerbrose 客户端。这是 kdc 服务器上的 krb5.ini。
[libdefaults]
default_realm = HIGHGO.CA
# The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
# The following encryption type specification will be used by MIT Kerberos
# if uncommented. In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
#
# The only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).
# default_tgs_enctypes = des3-hmac-sha1
# default_tkt_enctypes = des3-hmac-sha1
# permitted_enctypes = des3-hmac-sha1
# The following libdefaults parameters are only for Heimdal Kerberos.
fcc-mit-ticketflags = true
[realms]
HIGHGO.CA = {
kdc = kdc.highgo.ca
admin_server = kdc.highgo.ca
}
ATHENA.MIT.EDU = {
kdc = kerberos.mit.edu
kdc = kerberos-1.mit.edu
kdc = kerberos-2.mit.edu:88
admin_server = kerberos.mit.edu
default_domain = mit.edu
}
ZONE.MIT.EDU = {
kdc = casio.mit.edu
kdc = seiko.mit.edu
admin_server = casio.mit.edu
}
CSAIL.MIT.EDU = {
admin_server = kerberos.csail.mit.edu
default_domain = csail.mit.edu
}
IHTFP.ORG = {
kdc = kerberos.ihtfp.org
admin_server = kerberos.ihtfp.org
}
1TS.ORG = {
kdc = kerberos.1ts.org
admin_server = kerberos.1ts.org
}
ANDREW.CMU.EDU = {
admin_server = kerberos.andrew.cmu.edu
default_domain = andrew.cmu.edu
}
CS.CMU.EDU = {
kdc = kerberos-1.srv.cs.cmu.edu
kdc = kerberos-2.srv.cs.cmu.edu
kdc = kerberos-3.srv.cs.cmu.edu
admin_server = kerberos.cs.cmu.edu
}
DEMENTIA.ORG = {
kdc = kerberos.dementix.org
kdc = kerberos2.dementix.org
admin_server = kerberos.dementix.org
}
stanford.edu = {
kdc = krb5auth1.stanford.edu
kdc = krb5auth2.stanford.edu
kdc = krb5auth3.stanford.edu
master_kdc = krb5auth1.stanford.edu
admin_server = krb5-admin.stanford.edu
default_domain = stanford.edu
}
UTORONTO.CA = {
kdc = kerberos1.utoronto.ca
kdc = kerberos2.utoronto.ca
kdc = kerberos3.utoronto.ca
admin_server = kerberos1.utoronto.ca
default_domain = utoronto.ca
}
[domain_realm]
.mit.edu = ATHENA.MIT.EDU
mit.edu = ATHENA.MIT.EDU
.media.mit.edu = MEDIA-LAB.MIT.EDU
media.mit.edu = MEDIA-LAB.MIT.EDU
.csail.mit.edu = CSAIL.MIT.EDU
csail.mit.edu = CSAIL.MIT.EDU
.whoi.edu = ATHENA.MIT.EDU
whoi.edu = ATHENA.MIT.EDU
.stanford.edu = stanford.edu
.slac.stanford.edu = SLAC.STANFORD.EDU
.toronto.edu = UTORONTO.CA
.utoronto.ca = UTORONTO.CA
创造原则
setspn -A postgres/pg.highgo.ca@HIGHGO.CA postgres
创建原理后，我使用以下命令对其进行了测试
c:\Users\administrator\Desktop>kinit postgres
Password for postgres@HIGHGO.CA:
这工作正常。
这就是我创建密钥选项卡的方式
ktpass -out pgkt.keytab -princ postgres/pg.highgo.ca@HIGHGI.CA
-mapUser enterprisedb -pass Casper@12 -crypto all -ptype KRB5_NT_PRINCIPAL
并在 postgres 服务器中 cpoy 此文件并将其替换为具有以下权限的文件 /etc/krb5.keytab 。
chmod 600 /etc/krb5.keytab
这是我在 linux 和 windows 上的 /etc/host 条目。
192.168.100.112 pg.highgo.ca
192.168.100.114 kdc.highgo.ca
我已经在 postgress.conf 中输入了一个条目。
krb_server_keyfile = '/etc/krb5.keytab'
这是 pg_hba.conf 条目。
host all all 0.0.0.0/0 gss include_realm=0
之后，我尝试使用以下命令访问 postgress 服务器。
psql -U postgres -d postgress -h 192.168.100.114
作为回应，我在 Windows 上收到以下错误。
psql: error: could not connect to server: SSPI continuation error: The specified target is unknown or unreachable
(80090303)
并看到了postgtes上的日志。
2020-08-18 05:49:36.534 PDT [5086] [unknown]@[unknown] LOG: connection failed during start up processing: user= database=
2020-08-18 05:49:36.541 PDT [5087] postgres@postgres FATAL: GSSAPI authentication failed for user "postgress"
2020-08-18 05:49:36.541 PDT [5087] postgres@postgres DETAIL: Connection matched pg_hba.conf line 97: "host all all 0.0.0.0/0 gss include_realm=0 "
我检查了很多教程，但没有机会解决它。
（注意：相同的命令适用于 MD5 身份验证）
提前谢谢。